Merge "XSS Vulnerability fix in DashboardSearchResultController"

diff --git a/ecomp-portal-BE-common/pom.xml b/ecomp-portal-BE-common/pom.xml
index b8787f7..aca5e2a 100644 (file)
--- a/ecomp-portal-BE-common/pom.xml
+++ b/ecomp-portal-BE-common/pom.xml
@@ -600,6 +600,24 @@
                        <artifactId>jackson-jaxrs-json-provider</artifactId>
                        <version>2.8.10</version>
                </dependency>
+               <!-- https://mvnrepository.com/artifact/org.glassfish.web/javax.el -->
+               <dependency>
+                       <groupId>org.glassfish.web</groupId>
+                       <artifactId>javax.el</artifactId>
+                       <version>2.2.6</version>
+               </dependency>
+               <!-- https://mvnrepository.com/artifact/javax.el/el-api -->
+               <dependency>
+                       <groupId>javax.el</groupId>
+                       <artifactId>el-api</artifactId>
+                       <version>2.2.1-b04</version>
+               </dependency>
+               <!-- https://mvnrepository.com/artifact/org.jsoup/jsoup -->
+               <dependency>
+                       <groupId>org.jsoup</groupId>
+                       <artifactId>jsoup</artifactId>
+                       <version>1.12.1</version>
+               </dependency>
                <dependency>
                        <groupId>org.glassfish.jersey.connectors</groupId>
                        <artifactId>jersey-jetty-connector</artifactId>

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/DashboardSearchResultController.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/DashboardSearchResultController.java
index 29f5b20..04ee5e0 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/DashboardSearchResultController.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/controller/DashboardSearchResultController.java
@@ -45,8 +45,14 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 
+import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 
+import javax.validation.ConstraintViolation;
+import javax.validation.Valid;
+import javax.validation.Validation;
+import javax.validation.Validator;
+import javax.validation.ValidatorFactory;
 import org.onap.portalapp.controller.EPRestrictedBaseController;
 import org.onap.portalapp.portal.domain.EPUser;
 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
@@ -56,6 +62,7 @@ import org.onap.portalapp.portal.service.DashboardSearchService;
 import org.onap.portalapp.portal.transport.CommonWidget;
 import org.onap.portalapp.portal.transport.CommonWidgetMeta;
 import org.onap.portalapp.util.EPUserUtils;
+import org.onap.portalapp.validation.SecureString;
 import org.onap.portalsdk.core.domain.support.CollaborateList;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -68,6 +75,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @RequestMapping("/portalApi/search")
 public class DashboardSearchResultController extends EPRestrictedBaseController {
+       private static final ValidatorFactory VALIDATOR_FACTORY = Validation.buildDefaultValidatorFactory();
 
        private static EELFLoggerDelegate logger = EELFLoggerDelegate.getLogger(DashboardSearchResultController.class);
 
@@ -85,8 +93,11 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
        @RequestMapping(value = "/widgetData", method = RequestMethod.GET, produces = "application/json")
        public PortalRestResponse<CommonWidgetMeta> getWidgetData(HttpServletRequest request,
                        @RequestParam String resourceType) {
-               return new PortalRestResponse<CommonWidgetMeta>(PortalRestStatusEnum.OK, "success",
-                               searchService.getWidgetData(resourceType));
+               if (stringIsNotSafeHtml(resourceType)) {
+                               return new PortalRestResponse(PortalRestStatusEnum.ERROR, "resourceType: String string is not valid", "");
+               }
+               return new PortalRestResponse<>(PortalRestStatusEnum.OK, "success",
+                       searchService.getWidgetData(resourceType));
        }
 
        /**
@@ -97,19 +108,26 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
         * @return Rest response wrapped around a String; e.g., "success" or "ERROR"
         */
        @RequestMapping(value = "/widgetDataBulk", method = RequestMethod.POST, produces = "application/json")
-       public PortalRestResponse<String> saveWidgetDataBulk(@RequestBody CommonWidgetMeta commonWidgetMeta) {
+       public PortalRestResponse<String> saveWidgetDataBulk(@Valid @RequestBody CommonWidgetMeta commonWidgetMeta) {
                logger.debug(EELFLoggerDelegate.debugLogger, "saveWidgetDataBulk: argument is {}", commonWidgetMeta);
-               if (commonWidgetMeta.getCategory() == null || commonWidgetMeta.getCategory().trim().equals(""))
-                       return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, "ERROR",
-                                       "Category cannot be null or empty");
+               if (commonWidgetMeta.getCategory() == null || commonWidgetMeta.getCategory().trim().equals("")){
+                       return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ERROR",
+                               "Cateogry cannot be null or empty");
+               }else {
+                       Validator validator = VALIDATOR_FACTORY.getValidator();
+                       Set<ConstraintViolation<CommonWidgetMeta>> constraintViolations = validator.validate(commonWidgetMeta);
+                       if (!constraintViolations.isEmpty())
+                               return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ERROR",
+                                       "Category is not valid");
+               }
                // validate dates
                for (CommonWidget cw : commonWidgetMeta.getItems()) {
                        String err = validateCommonWidget(cw);
                        if (err != null)
-                               return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, err, null);
+                               return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, err, null);
                }
-               return new PortalRestResponse<String>(PortalRestStatusEnum.OK, "success",
-                               searchService.saveWidgetDataBulk(commonWidgetMeta));
+               return new PortalRestResponse<>(PortalRestStatusEnum.OK, "success",
+                       searchService.saveWidgetDataBulk(commonWidgetMeta));
        }
 
        /**
@@ -120,16 +138,23 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
         * @return Rest response wrapped around a String; e.g., "success" or "ERROR"
         */
        @RequestMapping(value = "/widgetData", method = RequestMethod.POST, produces = "application/json")
-       public PortalRestResponse<String> saveWidgetData(@RequestBody CommonWidget commonWidget) {
+       public PortalRestResponse<String> saveWidgetData(@Valid @RequestBody CommonWidget commonWidget) {
                logger.debug(EELFLoggerDelegate.debugLogger, "saveWidgetData: argument is {}", commonWidget);
-               if (commonWidget.getCategory() == null || commonWidget.getCategory().trim().equals(""))
-                       return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, "ERROR",
-                                       "Cateogry cannot be null or empty");
+               if (commonWidget.getCategory() == null || commonWidget.getCategory().trim().equals("")){
+                       return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ERROR",
+                               "Category cannot be null or empty");
+               }else {
+                       Validator validator = VALIDATOR_FACTORY.getValidator();
+                       Set<ConstraintViolation<CommonWidget>> constraintViolations = validator.validate(commonWidget);
+                       if (!constraintViolations.isEmpty())
+                               return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ERROR",
+                                       "Category is not valid");
+               }
                String err = validateCommonWidget(commonWidget);
                if (err != null)
-                       return new PortalRestResponse<String>(PortalRestStatusEnum.ERROR, err, null);
-               return new PortalRestResponse<String>(PortalRestStatusEnum.OK, "success",
-                               searchService.saveWidgetData(commonWidget));
+                       return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, err, null);
+               return new PortalRestResponse<>(PortalRestStatusEnum.OK, "success",
+                       searchService.saveWidgetData(commonWidget));
        }
 
        /**
@@ -162,10 +187,17 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
         * @return Rest response wrapped around a String; e.g., "success" or "ERROR"
         */
        @RequestMapping(value = "/deleteData", method = RequestMethod.POST, produces = "application/json")
-       public PortalRestResponse<String> deleteWidgetData(@RequestBody CommonWidget commonWidget) {
+       public PortalRestResponse<String> deleteWidgetData(@Valid @RequestBody CommonWidget commonWidget) {
+               if (commonWidget!=null){
+                       Validator validator = VALIDATOR_FACTORY.getValidator();
+                       Set<ConstraintViolation<CommonWidget>> constraintViolations = validator.validate(commonWidget);
+                       if (!constraintViolations.isEmpty())
+                               return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "ERROR",
+                                       "CommonWidget is not valid");
+               }
                logger.debug(EELFLoggerDelegate.debugLogger, "deleteWidgetData: argument is {}", commonWidget);
-               return new PortalRestResponse<String>(PortalRestStatusEnum.OK, "success",
-                               searchService.deleteWidgetData(commonWidget));
+               return new PortalRestResponse<>(PortalRestStatusEnum.OK, "success",
+                       searchService.deleteWidgetData(commonWidget));
        }
 
        /**
@@ -185,11 +217,14 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
                        if (user == null) {
                                return new PortalRestResponse<>(PortalRestStatusEnum.ERROR,
                                                "searchPortal: User object is null? - check logs",
-                                               new HashMap<String, List<SearchResultItem>>());
+                                       new HashMap<>());
                        } else if (searchString == null || searchString.trim().length() == 0) {
                                return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "searchPortal: String string is null",
-                                               new HashMap<String, List<SearchResultItem>>());
-                       } else {
+                                       new HashMap<>());
+                       }else if (stringIsNotSafeHtml(searchString)){
+                                       return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, "searchPortal: String string is not valid",
+                                               new HashMap<>());
+                       }else {
                                logger.debug(EELFLoggerDelegate.debugLogger, "searchPortal: user {}, search string '{}'",
                                                user.getLoginId(), searchString);
                                Map<String, List<SearchResultItem>> results = searchService.searchResults(user.getLoginId(),
@@ -199,7 +234,7 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
                } catch (Exception e) {
                        logger.error(EELFLoggerDelegate.errorLogger, "searchPortal failed", e);
                        return new PortalRestResponse<>(PortalRestStatusEnum.ERROR, e.getMessage() + " - check logs.",
-                                       new HashMap<String, List<SearchResultItem>>());
+                               new HashMap<>());
                }
        }
 
@@ -258,4 +293,13 @@ public class DashboardSearchResultController extends EPRestrictedBaseController
                }
        }
 
+       private boolean stringIsNotSafeHtml(String string){
+               SecureString secureString = new SecureString(string);
+
+               Validator validator = VALIDATOR_FACTORY.getValidator();
+
+               Set<ConstraintViolation<SecureString>> constraintViolations = validator.validate(secureString);
+               return !constraintViolations.isEmpty();
+       }
+
 }

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidget.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidget.java
index ec27d98..3fbdc3e 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidget.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidget.java
@@ -44,6 +44,7 @@ import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 
+import org.hibernate.validator.constraints.SafeHtml;
 import org.onap.portalsdk.core.domain.support.DomainVo;
 import com.fasterxml.jackson.annotation.JsonInclude;
 
@@ -63,28 +64,33 @@ public class CommonWidget extends DomainVo{
        private Long id;
 
        @Column(name = "category")
+       @SafeHtml
        public String category;
        
        @Column(name = "href")
+       @SafeHtml
        public String href;
 
        @Column(name = "title")
+       @SafeHtml
        public String title;
        
        @Column(name = "content")
+       @SafeHtml
        public String content;
 
        @Column(name = "event_date")
+       @SafeHtml
        public String eventDate;
        
        @Column(name = "sort_order")
        public Integer sortOrder;
 
-       
+
        public CommonWidget(){
-               
+
        }
-       
+
        public CommonWidget(String category, String href, String title, String content, String eventDate, Integer sortOrder){
                this.category = category;
                this.href = href;

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidgetMeta.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidgetMeta.java
index 55dfc91..51a0265 100644 (file)
--- a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidgetMeta.java
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/portal/transport/CommonWidgetMeta.java
@@ -38,14 +38,17 @@
 package org.onap.portalapp.portal.transport;
 
 import java.util.List;
+import javax.validation.Valid;
+import org.hibernate.validator.constraints.SafeHtml;
 
 public class CommonWidgetMeta {
-       
+       @SafeHtml
        private String category;
+       @Valid
        private List<CommonWidget> items;
-       
-       public CommonWidgetMeta(){      
-               
+
+       public CommonWidgetMeta(){
+
        }
 
        public CommonWidgetMeta(String category, List<CommonWidget> items){

diff --git a/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/validation/SecureString.java b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/validation/SecureString.java
new file mode 100644 (file)
index 0000000..ca2712a
--- /dev/null
+++ b/ecomp-portal-BE-common/src/main/java/org/onap/portalapp/validation/SecureString.java
@@ -0,0 +1,55 @@
+/*-
+ * ============LICENSE_START==========================================
+ * ONAP Portal
+ * ===================================================================
+ * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *             http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *             https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ *
+ */
+
+package org.onap.portalapp.validation;
+
+import org.hibernate.validator.constraints.SafeHtml;
+
+public class SecureString {
+
+       @SafeHtml
+       private String string;
+
+       public SecureString(String string) {
+              this.string = string;
+       }
+
+       public String getString() {
+              return string;
+       }
+}

diff --git a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/DashboardSearchResultControllerTest.java b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/DashboardSearchResultControllerTest.java
index 839b9fd..3466785 100644 (file)
--- a/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/DashboardSearchResultControllerTest.java
+++ b/ecomp-portal-BE-common/src/test/java/org/onap/portalapp/portal/controller/DashboardSearchResultControllerTest.java
@@ -93,7 +93,7 @@ public class DashboardSearchResultControllerTest {
        @Test
        public void getWidgetDataTest() {
                String resourceType = "test";
-               PortalRestResponse<CommonWidgetMeta> ecpectedPortalRestResponse = new PortalRestResponse<CommonWidgetMeta>();
+               PortalRestResponse<CommonWidgetMeta> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("success");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.OK);
@@ -104,9 +104,22 @@ public class DashboardSearchResultControllerTest {
 
        }
 
+       @Test
+       public void getWidgetDataXSSTest() {
+               String resourceType = "\"<IMG SRC=\\\"jav\\tascript:alert('XSS');\\\">\"";
+               PortalRestResponse expectedPortalRestResponse = new PortalRestResponse<>();
+               expectedPortalRestResponse.setMessage("resourceType: String string is not valid");
+               expectedPortalRestResponse.setResponse("");
+               expectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
+               Mockito.when(searchService.getWidgetData(resourceType)).thenReturn(null);
+               PortalRestResponse acutualPoratlRestResponse = dashboardSearchResultController
+                       .getWidgetData(mockedRequest, resourceType);
+               assertEquals(expectedPortalRestResponse,acutualPoratlRestResponse);
+       }
+
        @Test
        public void saveWidgetDataBulkTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("success");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.OK);
@@ -114,7 +127,7 @@ public class DashboardSearchResultControllerTest {
                CommonWidgetMeta commonWidgetMeta = new CommonWidgetMeta();
                commonWidgetMeta.setCategory("test");
 
-               List<CommonWidget> commonWidgetList = new ArrayList<CommonWidget>();
+               List<CommonWidget> commonWidgetList = new ArrayList<>();
                CommonWidget commonWidget = new CommonWidget();
                commonWidget.setId((long) 1);
                commonWidget.setCategory("test");
@@ -135,9 +148,40 @@ public class DashboardSearchResultControllerTest {
                assertEquals(actualPortalRestResponse, ecpectedPortalRestResponse);
        }
 
+       @Test
+       public void saveWidgetDataBulkXSSTest() {
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
+               ecpectedPortalRestResponse.setMessage("ERROR");
+               ecpectedPortalRestResponse.setResponse("Category is not valid");
+               ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
+
+               CommonWidgetMeta commonWidgetMeta = new CommonWidgetMeta();
+               commonWidgetMeta.setCategory("test");
+
+               List<CommonWidget> commonWidgetList = new ArrayList<>();
+               CommonWidget commonWidget = new CommonWidget();
+               commonWidget.setId((long) 1);
+               commonWidget.setCategory("test");
+               commonWidget.setHref("\"<IMG SRC=\\\"jav\\tascript:alert('XSS');\\\">\"");
+               commonWidget.setTitle("test_title");
+               commonWidget.setContent("test_content");
+               commonWidget.setEventDate(null);
+               commonWidget.setSortOrder(1);
+
+               commonWidgetList.add(commonWidget);
+
+               commonWidgetMeta.setItems(commonWidgetList);
+
+               Mockito.when(searchService.saveWidgetDataBulk(commonWidgetMeta)).thenReturn(null);
+
+               PortalRestResponse<String> actualPortalRestResponse = dashboardSearchResultController
+                       .saveWidgetDataBulk(commonWidgetMeta);
+               assertEquals(ecpectedPortalRestResponse, actualPortalRestResponse);
+       }
+
        @Test
        public void saveWidgetDataBulkIfCategoryNullTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("java.text.ParseException: Unparseable date: \"1\"");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
@@ -145,7 +189,7 @@ public class DashboardSearchResultControllerTest {
                CommonWidgetMeta commonWidgetMeta = new CommonWidgetMeta();
                commonWidgetMeta.setCategory("test");
 
-               List<CommonWidget> commonWidgetList = new ArrayList<CommonWidget>();
+               List<CommonWidget> commonWidgetList = new ArrayList<>();
                CommonWidget commonWidget = new CommonWidget();
                commonWidget.setId(null);
                commonWidget.setCategory(null);
@@ -166,7 +210,7 @@ public class DashboardSearchResultControllerTest {
 
        @Test
        public void saveWidgetDataTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("success");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.OK);
@@ -187,11 +231,34 @@ public class DashboardSearchResultControllerTest {
 
        }
 
+       @Test
+       public void saveWidgetDataXSSTest() {
+               PortalRestResponse<String> expectedPortalRestResponse = new PortalRestResponse<>();
+               expectedPortalRestResponse.setMessage("ERROR");
+               expectedPortalRestResponse.setResponse("Category is not valid");
+               expectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
+               CommonWidget commonWidget = new CommonWidget();
+               commonWidget.setId((long) 1);
+               commonWidget.setCategory("test");
+               commonWidget.setHref("\"<IMG SRC=\"jav\\tascript:alert('XSS');\">\"");
+               commonWidget.setTitle("test_title");
+               commonWidget.setContent("test_content");
+               commonWidget.setEventDate(null);
+               commonWidget.setSortOrder(1);
+
+               Mockito.when(searchService.saveWidgetData(commonWidget)).thenReturn(null);
+
+               PortalRestResponse<String> actualPortalRestResponse = dashboardSearchResultController
+                       .saveWidgetData(commonWidget);
+               assertEquals(expectedPortalRestResponse, actualPortalRestResponse);
+
+       }
+
        @Test
        public void saveWidgetDataExceptionTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("ERROR");
-               ecpectedPortalRestResponse.setResponse("Cateogry cannot be null or empty");
+               ecpectedPortalRestResponse.setResponse("Category cannot be null or empty");
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
                CommonWidget commonWidget = new CommonWidget();
                commonWidget.setId((long) 1);
@@ -212,7 +279,7 @@ public class DashboardSearchResultControllerTest {
 
        @Test
        public void saveWidgetDataDateErrorTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("java.text.ParseException: Unparseable date: \"1\"");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
@@ -233,8 +300,9 @@ public class DashboardSearchResultControllerTest {
 
        }
 
+       @Test
        public void deleteWidgetDataTest() {
-               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<String>();
+               PortalRestResponse<String> ecpectedPortalRestResponse = new PortalRestResponse<>();
                ecpectedPortalRestResponse.setMessage("success");
                ecpectedPortalRestResponse.setResponse(null);
                ecpectedPortalRestResponse.setStatus(PortalRestStatusEnum.OK);
@@ -254,15 +322,37 @@ public class DashboardSearchResultControllerTest {
                assertEquals(actualPortalRestResponse, ecpectedPortalRestResponse);
        }
 
+       @Test
+       public void deleteWidgetDataXSSTest() {
+               PortalRestResponse<String> expectedPortalRestResponse = new PortalRestResponse<>();
+               expectedPortalRestResponse.setMessage("ERROR");
+               expectedPortalRestResponse.setResponse("CommonWidget is not valid");
+               expectedPortalRestResponse.setStatus(PortalRestStatusEnum.ERROR);
+               CommonWidget commonWidget = new CommonWidget();
+               commonWidget.setId((long) 1);
+               commonWidget.setCategory("test");
+               commonWidget.setHref("test_href");
+               commonWidget.setTitle("\"<IMG SRC=\"jav\\tascript:alert('XSS');\">\"");
+               commonWidget.setContent("test_content");
+               commonWidget.setEventDate(null);
+               commonWidget.setSortOrder(1);
+               Mockito.when(searchService.deleteWidgetData(commonWidget)).thenReturn(null);
+
+               PortalRestResponse<String> actualPortalRestResponse = dashboardSearchResultController
+                       .deleteWidgetData(commonWidget);
+
+               assertEquals(expectedPortalRestResponse, actualPortalRestResponse);
+       }
+
        @Test
        public void searchPortalIfUserIsNull() {
                EPUser user = null;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String searchString = "test";
 
-               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<Map<String, List<SearchResultItem>>>();
+               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("searchPortal: User object is null? - check logs");
-               expectedResult.setResponse(new HashMap<String, List<SearchResultItem>>());
+               expectedResult.setResponse(new HashMap<>());
                expectedResult.setStatus(PortalRestStatusEnum.ERROR);
                PortalRestResponse<Map<String, List<SearchResultItem>>> actualResult = dashboardSearchResultController
                                .searchPortal(mockedRequest, searchString);
@@ -272,13 +362,12 @@ public class DashboardSearchResultControllerTest {
        @Test
        public void searchPortalIfSearchStringNullTest() {
                EPUser user = mockUser.mockEPUser();
-               ;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String searchString = null;
 
-               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<Map<String, List<SearchResultItem>>>();
+               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("searchPortal: String string is null");
-               expectedResult.setResponse(new HashMap<String, List<SearchResultItem>>());
+               expectedResult.setResponse(new HashMap<>());
                expectedResult.setStatus(PortalRestStatusEnum.ERROR);
 
                PortalRestResponse<Map<String, List<SearchResultItem>>> actualResult = dashboardSearchResultController
@@ -289,10 +378,9 @@ public class DashboardSearchResultControllerTest {
        @Test
        public void searchPortalIfSearchTest() {
                EPUser user = mockUser.mockEPUser();
-               ;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String searchString = "test";
-               List<SearchResultItem> searchResultItemList = new ArrayList<SearchResultItem>();
+               List<SearchResultItem> searchResultItemList = new ArrayList<>();
                SearchResultItem searchResultItem = new SearchResultItem();
 
                searchResultItem.setId((long) 1);
@@ -301,10 +389,10 @@ public class DashboardSearchResultControllerTest {
                searchResultItem.setTarget("test_target");
                searchResultItem.setUuid("test_UUId");
                searchResultItemList.add(searchResultItem);
-               Map<String, List<SearchResultItem>> expectedResultMap = new HashMap<String, List<SearchResultItem>>();
+               Map<String, List<SearchResultItem>> expectedResultMap = new HashMap<>();
                expectedResultMap.put(searchString, searchResultItemList);
 
-               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<Map<String, List<SearchResultItem>>>();
+               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("success");
                expectedResult.setResponse(expectedResultMap);
                expectedResult.setStatus(PortalRestStatusEnum.OK);
@@ -319,13 +407,12 @@ public class DashboardSearchResultControllerTest {
        @Test
        public void searchPortalIfSearchExcptionTest() {
                EPUser user = mockUser.mockEPUser();
-               ;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String searchString = "test";
 
-               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<Map<String, List<SearchResultItem>>>();
+               PortalRestResponse<Map<String, List<SearchResultItem>>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("null - check logs.");
-               expectedResult.setResponse(new HashMap<String, List<SearchResultItem>>());
+               expectedResult.setResponse(new HashMap<>());
                expectedResult.setStatus(PortalRestStatusEnum.ERROR);
 
                Mockito.when(searchService.searchResults(user.getLoginId(), searchString)).thenThrow(nullPointerException);
@@ -336,9 +423,8 @@ public class DashboardSearchResultControllerTest {
 
        @Test
        public void getActiveUsersTest() {
-               List<String> expectedActiveUsers = new ArrayList<String>();
+               List<String> expectedActiveUsers = new ArrayList<>();
                EPUser user = mockUser.mockEPUser();
-               ;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String userId = user.getOrgUserId();
                Mockito.when(searchService.getRelatedUsers(userId)).thenReturn(expectedActiveUsers);
@@ -349,7 +435,7 @@ public class DashboardSearchResultControllerTest {
 
        @Test
        public void getActiveUsersExceptionTest() {
-               List<String> expectedActiveUsers = new ArrayList<String>();
+               List<String> expectedActiveUsers = new ArrayList<>();
                EPUser user = mockUser.mockEPUser();
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
                String userId = user.getOrgUserId();
@@ -363,7 +449,7 @@ public class DashboardSearchResultControllerTest {
        public void activeUsersTest() {
                EPUser user = mockUser.mockEPUser();
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
-               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<List<String>>();
+               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("success");
                expectedResult.setResponse(new ArrayList<>());
                expectedResult.setStatus(PortalRestStatusEnum.OK);
@@ -377,7 +463,7 @@ public class DashboardSearchResultControllerTest {
        public void activeUsersIfUserNullTest() {
                EPUser user = null;
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
-               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<List<String>>();
+               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("User object is null? - check logs");
                expectedResult.setResponse(new ArrayList<>());
                expectedResult.setStatus(PortalRestStatusEnum.ERROR);
@@ -390,7 +476,7 @@ public class DashboardSearchResultControllerTest {
        public void activeUsersExceptionTest() {
                EPUser user = mockUser.mockEPUser();
                Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
-               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<List<String>>();
+               PortalRestResponse<List<String>> expectedResult = new PortalRestResponse<>();
                expectedResult.setMessage("null - check logs.");
                expectedResult.setResponse(new ArrayList<>());
                expectedResult.setStatus(PortalRestStatusEnum.ERROR);